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Amendments 

1. (Previously Amended) A computer-implemented method for configuring 
and scheduling a security audit of a computer network comprising the steps of: 

conducting a discovery scan to identify an element of the computer 
network and determine the element's Amotions and assigning an asset value for the element, 
wherein the asset value indicates the relative importance of the element in the network; 

configuring an audit scan to perform on the element, wherein the audit 
scan is a broader scan than the discovery scan; 

scheduling a time to perform the audit scan on the element; 

running the audit scan of the element at the scheduled time; 

calculating a security score for the element based on the audit scan by 
summing one or more vulnerabilities associated with the element; and 

scheduling another time to repeat the audit scan on the element, the 
scheduling based on the results of the audit scan and the security score. 

2. (Original) The method of Claim 1, further comprising the step of 
configuring a subsequent audit scan of the element that is different from the audit scan. 

3. (Original) The method of Claim 1, further comprising the step of receiving 
a blackout time during which no audit scan can be scheduled. 

4. (Original) The method of Claim l f wherein the step of conducting a 
discovery scan further comprises identifying the function of the element. 

5. (Previously Amended) The method of Claim 1, wherein the step of 
conducting a discovery scan further comprises identifying the one or more vulnerabilities 
associated with the element. 

6. (Canceled) 
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7. (Currently Amended) The method of Claim [[6]] L wherein the asset 
value is modified based on the audit scan. 

8. (Original) The method of Claim 1, ftuther comprising the step of receiving 
a manually selected asset value for the element. 

9. (Original) The method of Claim 1, wherein the step of configuring an 
audit scan comprises selecting a type of audit scan based on the discovery scan, 

10. (Currently Amended) The method of Claim 1, wherein the step of 
configuring an audit scan comprises: 

retrieving an asset value based on the discovery scan; 

retrieving a scan frequency associated with the asset value, wherein the 
scan frequency indicates how often the scan is performed; [[and]] 

assigning a role based on the discovery scan, wherein the role indicates the 
function of the element; and 

assigning a policy based on the discovery scan, wherein the policy 
indicates the type of audit scan. 

11. (Original) The method of Claim 1, wherein the step of configuring an 
audit scan comprises manually selecting the type of audit scan. 

Claims 12 - 45 (Canceled) 
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46. (New) A computer program product for implementing security for a computing 
device, said computer program product comprising: 

a computer readable medium; 

first program instructions to conduct a discovery scan to identify an element of the 
computer network and determine the element's functions and assign an asset value for the 
element, wherein the asset value indicates the relative importance of the element in the network; 

second program instructions to configure an audit scan to perform on the element, 
wherein the audit scan is a broader scan than the discovery scan; 

third program instructions to schedule a time to perform the audit scan on the 

element; 

fourth program instructions to run the audit scan of the element at the scheduled 

time; 

fifth program instructions to calculate a security score for the element based on 
the audit scan by summing one or more vulnerabilities associated with the element; and 

sixth program instructions to schedule another time to repeat the audit scan on the 
element, the scheduling based on the results of the audit scan and the security score. 

47. (New) The computer program product of Claim 46, further comprising seventh 
program instructions to configure a subsequent audit scan of the element that is different from the 
audit scan. 

48. (New) The computer program product of Claim 46, further comprising eighth 
program instructions to receive a blackout time during which no audit scan can be scheduled. 

49. (New) The computer program product of Claim 46, wherein the first program 
instructions further comprise instructions to identify the function of the element. 

50. (New) The computer program product of Claim 46, wherein the first program 
instructions further comprise instructions to identify the one or more vulnerabilities associated 
with the element. 
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5 1 . (New) The computer program product of Claim 46, further comprising ninth 
program instructions to modify the asset value based on the audit scan. 

52. (New) The computer program product of Claim 46, further comprising tenth 
program instructions to receive a manually selected asset value for the element. 

53. (New) The computer program product of Claim 46, wherein the second program 
instructions further comprise instructions to select a type of audit scan based on the discovery 
scan. 

54. (New) The computer program product of Claim 46, wherein the second program 
instructions further comprise instructions to: 

retrieve an asset value based on the discovery scan; 

retrieve a scan frequency associated with the asset value, wherein the scan 
frequency indicates how often the scan is performed; 

assign a role based on the discovery scan, wherein the role indicates the 
function of the element; and 

assign a policy based on the discovery scan, wherein the policy indicates 

the type of audit scan. 
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